When writing custom correlation rules, the analyst should focus on

multiple security controls and events specific to the environment.

any one specific high-quality indicator of compromise.

malware alerts announced by industry security groups

firewall events, as they provide the first indication of a compromise